convex — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited convex (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Start here, pick the matching skill below, and load it. If nothing matches, the rules at the bottom still apply.
| Skill | Load when |
|---|---|
| convex-best-practices | general patterns, project structure, "is this the Convex way" |
| convex-functions | queries, mutations, actions, internal functions, error handling |
| convex-schema-validator | tables, indexes, validators, v.* types, schema changes |
| convex-realtime | useQuery, optimistic updates, pagination, presence, rerender churn |
| convex-http-actions | webhooks, REST endpoints, convex/http.ts, Stripe or Clerk callbacks |
| convex-file-storage | uploads, upload URLs, serving files, storage cleanup |
| convex-cron-jobs | crons.ts, runAfter, runAt, batching, a cron that is not firing |
| convex-migrations | backfills, renaming fields, schema evolution with live data |
| convex-agents | AI agents, threads, tools, streaming, RAG with @convex-dev/agent |
| convex-component-authoring | building a reusable component package, defineComponent |
| convex-security-check | fast pre ship audit: auth on public functions, exposed data |
| convex-security-audit | deep review: authorization model, injection, rate limits, secrets |
| avoid-feature-creep | scope pushback, MVP cuts, "just one more feature" |
| project-workflow | multi step tasks, PRDs in prds/, task.md, plans for review |
| project-docs | syncing task.md, changelog.md, files.md with shipped code |
| git-safety | revert, undo, reset, checkout, clean, stash, force push |
Two skills often apply at once. Load the domain skill for the code and the process skill for the workflow, for example convex-functions plus project-workflow.
args and returns validators, including internal ones.withIndex. .filter() on a table scan is a bug waiting for data.internal.* functions. Never api.*.Date.now() inside a query. Pass time in as an argument.npx convex dev for development. Do not run npx convex deploy unless asked.convex/_generated/.crons.daily, crons.hourly, or crons.weekly. Use crons.interval or crons.cron."use node" in a file that also exports queries or mutations.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.